Privacy Notice

Who we are

This website is run by Web Zero Digital Sustainability Ltd, trading as Web Zero ("Web Zero", "we"), a company registered in England and Wales (company number 17300202). For anything in this notice, or to use any of the rights below, email Enquiries@web-zero.co.uk.

This notice covers this website, including the Web Zero Academy. Carbon Shrinker (carbon-shrinker.com) has its own Privacy Notice inside its app.

What we collect, and why

When you just visit

You don't need an account to browse this website or to see the Academy's courses, and it doesn't use analytics, advertising trackers or content from other websites. Like almost every website, our server keeps basic technical logs (such as your IP address, the page you asked for and the time) so we can keep the site secure and fix problems. To stop the forms being abused by bots, your IP address is also held in the server's memory for up to an hour and is not stored anywhere.

On our Partners page, each link to a partner's website goes through our own server first, which adds one to a simple count for that partner (the partner, the time, and which of our pages you clicked from) and then sends you on. We don't record who you are, your IP address or your browser in that count, and it uses no cookies. The partner's website adds a note to the address that the visit came from web-zero.co.uk, so they can see their visits from us. Once you are on their website, their own privacy notice applies.

When you use the contact form

Your name, email address, phone number (optional), the topic you choose, your subject and your message. It is emailed to the Web Zero team member who looks after that topic, so we can reply to you. We also keep a copy in our own database and log it as an enquiry in our customer records (Zoho), so nothing gets lost. Resend, which sends the email, keeps its own delivery record.

When you request a free Website Assessment

Your website address and your email address. We use them to email you a confirmation link (which proves the email address is yours), to check that your email address is at the same domain as the website, and then to build and email you your report. Once your email address is confirmed we also log the request as a follow-up in our customer records (Zoho). The assessment reads the public pages of your website and uses an AI service (OpenAI) to assess them. Your email address is not sent to the AI service, and the report file is deleted once it has been emailed to you.

Our report service keeps a record of each request (your email address, the website address, the date and whether it succeeded). It needs this to enforce the limit of one free report per website every 28 days. It does not delete these records automatically.

When you create a Web Zero Academy account

Your email address and a password (stored as a one-way bcrypt hash - we never see or store your actual password). We email you a link to confirm the address is yours. When you sign in, a small cookie keeps you signed in (see Cookies below).

When you buy a course

You pay on Stripe's own secure checkout page: card details are entered directly into Stripe, and we never see or store your card number. We keep a record of what you bought, how much was paid and when, and Stripe tells us when the payment has gone through so we can give you access. Your access runs from the day you buy; if you haven't finished after three months we email you one reminder. Your access isn't closed.

When you buy for an organisation

The person setting up the order gives us the organisation's name, who the invoice should go to (name and email address), and the email addresses of the people who will take the course. We send the invoice through Stripe, and once it is paid we give each of those people access. If they don't already have an account we create one for them and email them a link to choose a password. If your email address was added to an order by your employer or someone else, this is how we have it, and you can ask us to delete your account at any time.

As you take a course

We record which modules you have completed, and when, so that each one can unlock the next. For a quiz we keep the score from the attempt you passed; we don't keep your answers or any attempts you didn't pass. Course videos and documents are only available to people who are signed in and have access.

When you earn a certificate

When you complete a course that comes with a certificate, you type the full name you would like printed on it. We keep that name with the course title, the completion date and a certificate number, and we email you the certificate as a PDF. Each certificate carries a QR code that opens a public verification page showing that name, the course, the date, the certificate number and whether it is valid, so that an employer or client can check it is genuine. The page isn't in our menu or in search engines, can't be searched by name, and sits at an address with a long random code, but anyone who has the link or the QR code can see it. We keep certificate records so they can always be verified. If you ask us to remove your name, we delete it, and the page will then say the certificate was withdrawn at the holder's request.

We only use your details for what is described here. We don't send marketing emails (the emails we send are the ones described above: confirmation links, a one-off three-month reminder and your certificate), and we never sell or trade personal data.

Our legal basis

You asked us for something, such as a reply to your enquiry, a report, or a course, so we use your details to do it. Where you buy training, our legal basis is contract: we need your details to give you the course and the certificate you paid for. For enquiries and reports it is legitimate interests (running the website and answering the people who contact us) and, where you are asking about becoming a customer, taking steps at your request. Keeping certificate records so that anyone can check a certificate is genuine is also a legitimate interest, as is keeping basic technical logs, which keeps the site secure.

Who we share it with

A small number of providers help us run the website, each only for the job named here:

• Hostinger hosts this website, its database and our email.
• Resend sends the emails the website sends (your contact message to our team, the assessment confirmation and report, and the Academy's confirmation links, reminders and certificates).
• Stripe takes payments and sends invoices for Academy courses.
• Zoho holds our own internal customer records (enquiries and assessment requests).
• Railway runs the free assessment service.
• OpenAI assesses the public content of the website you name. It doesn't receive your email address.

Where your data is stored

Our website and its database run on our own server at Hostinger. Some of our other providers are based in, or store data in, the United States, so your personal data can be transferred outside the UK. We only work with providers who take data protection seriously, and we're happy to answer questions about this if you ask.

How long we keep it

• Contact messages are kept for as long as we need to deal with your enquiry and any follow-up, and no longer than is reasonable after that.
• Academy accounts and learning records are kept for as long as your account is active. You can ask us to delete your account at any time.
• Payment records are kept for as long as accounting and tax rules require us to.
• Certificate records are kept indefinitely, so a certificate can always be verified. We remove your name from one if you ask.
• Free assessment records are kept so the 28-day limit can work. We don't currently delete them automatically, but you can ask us to.
• Server logs are kept only as long as needed for security and fixing problems.

You can ask us to delete your information at any time by emailing Enquiries@web-zero.co.uk.

Cookies

This website doesn't use tracking cookies or any third-party analytics. The only cookie is a sign-in cookie, set if you sign in to the Academy: a random token, meaningless on its own, that keeps you signed in for up to 30 days. It is strictly necessary for signing in, isn't shared with anyone and isn't used to track you, so it doesn't need a consent banner. If that ever changes, we'll update this notice and ask for your consent first wherever the law requires it.

Your rights (data protection and GDPR)

Under UK GDPR you can ask us to give you a copy of your information, correct it, delete it, restrict or object to how we use it, or move it elsewhere. Email Enquiries@web-zero.co.uk for any of these. If you're not happy with our answer, you can complain to the UK's Information Commissioner's Office at ico.org.uk.